Dual Perspective: Understand how the blue team finds you in memory → design red team countermeasures so you are not found
⛔ In-Depth Reference
- Volatility3 Complete Plugin Quick Reference and Practical Commands → references/volatility3-cheatsheet.md
- Anti-Memory Forensics Technical Implementation Details → references/anti-memory-forensics.md
Part A: Blue Team Perspective — Memory Forensics Analysis Workflow
Phase 1: Memory Acquisition
# Windows (DumpIt)
DumpIt.exe /OUTPUT memory.raw
winpmem_mini_x64.exe memory.raw
Linux (LiME)sudo insmod lime-$(uname -r).ko "path=memory.lime format=lime"
Remote (Velociraptor) Remotely acquire memory through the Velociraptor agent
### Phase 2: Volatility3 分析决策树
Memory analysis goal? ├─ Discover malicious processes → windows.pslist / windows.psscan / windows.cmdline ├─ Discover injected code → windows.malfind / windows.hollowprocesses ├─ Extract network connections → windows.netscan / windows.netstat ├─ Extract credentials → windows.hashdump / windows.lsadump ├─ Discover hidden processes → windows.psscan (scan freed EPROCESS) ├─ Rootkit detection → windows.ssdt / windows.callbacks └─ Extract files → windows.filescan / windows.dumpfiles
**核心命令：**
```bash
# 系统信息
vol -f mem.raw windows.info
# 进程列表（链表遍历 → 已 unlink 的看不到）
vol -f mem.raw windows.pslist
# 进程扫描（池标签扫描 → 能找到隐藏进程）
vol -f mem.raw windows.psscan
# ⛔ 对比 pslist vs psscan → 差异 = 隐藏进程
# pslist 有但 psscan 无 → 异常
# psscan 有但 pslist 无 → 被 unlink 的进程（Rootkit）
# 注入检测（PAGE_EXECUTE_READWRITE 内存区域）
vol -f mem.raw windows.malfind
# 网络连接
vol -f mem.raw windows.netscan
# DLL 列表
vol -f mem.raw windows.dlllist --pid <PID>
# 命令行参数
vol -f mem.raw windows.cmdline
Phase 3: Key Detection Indicators
| Blue Team Detection Item | Meaning |
|---|---|
| RWX memory pages (malfind) | Process injection/Shellcode |
| Abnormal parent process (svchost→cmd) | Malicious process creation chain |
| pslist ≠ psscan | Process hiding (DKOM) |
| Processes with the same name but different paths | Process masquerading |
| Abnormal VAD tags | Memory region tampered with |
| SSDT/IDT hook | Rootkit |
| Network connection to abnormal port | C2 communication |
Part B: Red Team Perspective — Anti-Memory Forensics
Strategy 1: Avoid being discovered by malfind
malfind 原理：扫描 PAGE_EXECUTE_READWRITE 的 VAD 节点
├─ 对策 1: 分配时用 RW，写入 shellcode 后改为 RX（不要 RWX）
├─ 对策 2: 使用 NtMapViewOfSection 映射 → 权限为 SECTION_MAP_EXECUTE
├─ 对策 3: Module Stomping — 覆盖合法 DLL 的 .text 节
└─ 对策 4: 使用回调执行（APC/Timer）→ 不创建远程线程
Strategy 2: Avoid process anomalies
父子进程关系审计绕过：
├─ Parent PID Spoofing → 伪造正常父进程
├─ 使用合法签名进程执行 → LOLBins
├─ 进程名/路径完全模仿 → svchost.exe 在正确路径
└─ 命令行参数正常化 → 不留异常 cmdline
Strategy 3: Memory encryption (Sleep Mask)
Cobalt Strike Sleep Mask 原理：
1. Beacon 进入 Sleep 状态前 → 加密自身在内存中的代码段
2. 加密期间 → malfind 只看到随机数据，无 MZ 头/PE 特征
3. 唤醒时 → 解密执行 → 完成任务 → 再加密
现代 C2 实现：
├─ Havoc: Ekko/Zilean sleep obfuscation（加密 + 更改内存保护）
├─ Sliver: 无需 sleep mask（Go 二进制特征不同）
├─ BRC4: 自带 heap 加密
└─ 自定义: SystemFunction032 (RC4) + VirtualProtect(RW)
Strategy 4: Avoid Credential Dump exposure
蓝队会检查 LSASS 访问：
├─ 对策: 用 MiniDumpWriteDump 的替代方式（NanoDump/HandleDuplicate）
├─ 对策: SSP 注入代替直接读取
├─ 对策: 使用 comsvcs.dll 的 MiniDump 导出函数
└─ 对策: Kerberos 票据攻击代替直接 dump
Strategy 5: Remove memory traces
⛔ 注意：内存获取通常是一次性快照，不像日志可以被删除
最佳策略：从一开始就不留痕迹（预防 > 清除）
有限清除手段：
├─ Unmap 已用内存区域 → VirtualFree
├─ 清除线程调用栈 → 伪造 Call Stack
├─ 结束并清理 worker 线程 → 不留挂起线程
└─ Module 卸载 + 内存置零
Comparison Table: Forensic Techniques vs Red Team Countermeasures
| Forensic Technique | What It Discovers | Red Team Countermeasure |
|---|---|---|
| pslist/psscan comparison | Hidden processes | Do not hide processes; masquerade as legitimate processes |
| malfind | Injected code | Module Stomping + RW→RX |
| netscan | C2 connection | Use legitimate traffic for obfuscation |
| hashdump | Credentials extracted | Use Kerberos instead of NTLM |
| handles | Open files/registry | Close handles immediately after use |
| callbacks/SSDT | Rootkit hook | Avoid kernel operations |
| YARA scan | Malicious signatures in memory | Sleep Mask encryption |
Tool Quick Reference
| Tool | Purpose | Direction |
|---|---|---|
| Volatility3 | Memory forensics framework | Blue |
| MemProcFS | Memory file system-based analysis | Blue |
| WinDbg | Kernel debugging/analysis | Blue |
| BeaconEye | Detect CS Beacon | Blue |
| Moneta | Detect memory injection | Blue |
| Sleep Mask Kit | CS sleep encryption | Red |
| SysWhispers3 | Direct syscall (bypass hook) | Red |
| NanoDump | LSASS low-detection dump | Red |